Masking

Applies to. Requirement 3.4.1 applies wherever PAN is displayed, on screen, on paper receipts or on printouts, for any merchant or service provider. At most the BIN and the last four digits may be shown, and anyone who sees more must belong to a role with a documented legitimate business need. The assessor examines the policy listing those roles, the system configuration that enforces the mask, and actual displays.

Example. A call-centre agent looks up a customer's order and the screen shows the BIN and last four digits with the middle digits replaced by asterisks. The fraud team's screen shows the full PAN because the masking policy names that role and states why; the agent's role is absent from the list, so the application never returns the full number to it.

Limits. Masking is a display control only. It does not change what is stored, so a masked screen backed by a database holding full PAN still needs 3.5.1; truncation is the storage counterpart, where the removed digits are gone rather than hidden. Masking is not encryption, hashing or tokenisation. BIN and last four is the maximum, not a default entitlement: 3.4.1 asks the entity to justify each role that sees more, and a mask applied only in the browser while the full PAN is still sent to the client does not meet 3.4.1.b, which examines what the system returns for other requests.